ISO 45001 Explained: What the Standard Requires on Competence, Training and Worker Participation

ISO 45001 is the international standard for occupational health and safety management systems. It replaced OHSAS 18001, it is the framework most large procurement exercises now ask about, and a second edition is close enough that anyone starting an implementation this year should know it is coming.

It is also the standard most often misunderstood by the people buying it. Certification is not a legal requirement anywhere in Great Britain or Ireland, and the Health and Safety Executive says so in unusually direct terms. This guide covers what the standard actually asks for, with particular attention to the training and competence requirements, because those are the ones that generate findings.

Status: what version applies, and what is coming

The current standard is ISO 45001:2018, "Occupational health and safety management systems — Requirements with guidance for use". It has been amended once: ISO 45001:2018/Amd 1:2024, "Amendment 1: Climate action changes", published in February 2024 as part of a cross-portfolio ISO amendment that brought climate change considerations into the context clauses.

A second edition is in progress. ISO’s own record for the revision shows ISO/DIS 45001 at the close-of-voting stage dated 9 September 2026, and ISO states it is expected to replace ISO 45001:2018 in the first half of 2027. If you are planning a certification cycle, that timing matters — a transition period will follow publication, as it did for the move from OHSAS 18001.

On that move: OHSAS 18001:2007 has been withdrawn. The migration period was three years from publication, giving a March 2021 deadline, which was extended to 11 September 2021 because of COVID-19. ISO/TC 283 records the extension as made through an IAF FAQ rather than a numbered resolution.

The ten clauses

ISO 45001 uses the harmonised structure shared across modern ISO management system standards, which is what makes it integrable with quality and compliance systems. Clauses 1 to 3 cover scope, normative references and terms. The requirements sit in clauses 4 to 10:

• 4 Context of the organization — 4.1 Understanding the organization and its context; 4.2 Understanding the needs and expectations of workers and other interested parties; 4.3 Determining the scope of the OH&S management system; 4.4 OH&S management system
• 5 Leadership and worker participation — 5.1 Leadership and commitment; 5.2 OH&S policy; 5.3 Organizational roles, responsibilities and authorities; 5.4 Consultation and participation of workers
• 6 Planning — 6.1 Actions to address risks and opportunities (6.1.1 General; 6.1.2 Hazard identification and assessment of risks and opportunities; 6.1.3 Determination of legal requirements and other requirements; 6.1.4 Planning action); 6.2 OH&S objectives and planning to achieve them
• 7 Support — 7.1 Resources; 7.2 Competence; 7.3 Awareness; 7.4 Communication; 7.5 Documented information
• 8 Operation — 8.1 Operational planning and control (including 8.1.2 Eliminating hazards and reducing OH&S risks; 8.1.3 Management of change; 8.1.4 Procurement); 8.2 Emergency preparedness and response
• 9 Performance evaluation — 9.1 Monitoring, measurement, analysis and performance evaluation; 9.2 Internal audit; 9.3 Management review
• 10 Improvement — 10.1 General; 10.2 Incident, nonconformity and corrective action; 10.3 Continual improvement

Note the title of clause 5. It is not "Leadership" as in the quality standard — it is "Leadership and worker participation", and that difference is deliberate.

Clause 7.2 Competence: the evidence requirement

Clause 7.2 is short and it is where auditors spend time. It requires the organisation to determine the competence necessary for persons doing work under its control that affects OH&S performance; to ensure those persons are competent on the basis of appropriate education, training or experience; to take action to acquire the necessary competence where applicable; to evaluate the effectiveness of those actions; and to retain documented information as evidence of competence.

Four things in that list trip organisations up. First, "determine the competence necessary" means a defined competence requirement per role, not a training matrix inherited from a template. Second, "education, training or experience" means a time-served operative can be competent without a certificate — but you then have to evidence the experience. Third, evaluating effectiveness is a separate obligation from delivering the training, and a completion record alone does not satisfy it. Fourth, the evidence has to be retained, which in practice means a system rather than a filing cabinet.

Clause 7.3 Awareness sits alongside it, covering what workers need to know about the policy, the hazards they face, incidents and their own ability to remove themselves from danger.

Clause 5.4: the requirement most implementations miss

If there is one clause that distinguishes ISO 45001 from a conventional safety management system, it is 5.4 Consultation and participation of workers. It requires consultation and participation at all applicable levels and functions, and it expressly includes non-managerial workers.

Most relevant for training: clause 5.4 requires that workers participate in determining competence requirements, training needs and training evaluation — the very things clause 7.2 asks for. In other words, the standard does not let management define the training plan alone. Workers also participate in determining the mechanisms for consultation, in hazard identification and risk assessment, in determining controls, in deciding what to communicate and how, and in incident investigation and corrective action.

Clause 5.4 also requires the organisation to remove obstacles and barriers to participation, and the standard gives examples that are worth quoting in a gap analysis: language differences, shift schedules, literacy levels and fear of reprisal. An organisation with a multilingual night shift and no translated materials has a clause 5.4 problem whatever its training completion rate says.

Where incident reporting and investigation are concerned, clause 10.2 and the participation requirement pull in the same direction. If you want a sense of what good investigation documentation looks like in a regulated setting, our guide to incident investigation documentation standards covers the records side, and RIDDOR reporting duties covers the statutory reporting that runs in parallel in Great Britain.

Certification is not a legal requirement — and the HSE says so

This is the part worth reading before signing a certification contract. The HSE’s own page on ISO 45001 states that implementing the standard "may help your organisation demonstrate compliance with health and safety law" — help, not satisfy. It goes further and addresses buyers directly: contracting bodies and customers should ask themselves whether the supplier really needs certification to ISO 45001.

The HSE also makes two points that matter for anyone outsourcing implementation. Inspectors assess compliance using a range of evidence, not whether an organisation claims to meet a standard. And using outside help does not transfer the duty — the organisation remains legally responsible for the day-to-day control of risk.

You can also use the standard without certifying to it, though you may only claim conformity if you implement it fully. For many employers, particularly in Ireland, the better starting point is the statutory framework and the regulator’s own guidance: the Health and Safety Authority’s position on mandatory training requirements is the baseline, and ISO 45001 is a management overlay on top of it.

How widely is it used?

The ISO Survey, which records certificates as at the end of each year, is the standard reference. As reported for the 2025 survey, with a reference date of 31 December 2025, ISO 45001 stood at 599,532 certificates, up from 542,527 certificates across 941,546 sites a year earlier.

Treat year-on-year growth in those figures carefully. ISO has moved the survey onto a certificate database with mandatory notification, replacing voluntary submissions from certification bodies, and earlier surveys were acknowledged to be incomplete — China provided no figures for one recent year. Growth across that methodology change may partly reflect better reporting coverage rather than real expansion.

Where this leaves training

ISO 45001 does not name a single course, specify a number of hours or endorse a qualification. What it requires is a defined competence standard per role, evidence that each person meets it, evaluation of whether the training worked, retained records, and worker involvement in setting the requirements in the first place.

In practice that means the vocational qualifications your safety staff hold — the NEBOSH National General Certificate for safety practitioners, IOSH Managing Safely for line managers — are evidence for clause 7.2 rather than a substitute for it, and the topic-specific obligations continue to apply underneath: CDM duty holder responsibilities on construction projects, and equipment duties such as those covered in our guide to PPE at work in Ireland.

Frequently asked questions

Is ISO 45001 certification a legal requirement?

No. It is not mandatory in Great Britain or Ireland. The HSE states that implementing it may help demonstrate compliance, and suggests customers consider whether certification is really needed.

Which clause covers training?

Clause 7.2 Competence and clause 7.3 Awareness, with clause 5.4 requiring worker participation in determining competence requirements, training needs and training evaluation.

Has ISO 45001 been updated since 2018?

Yes, once — Amendment 1:2024 on climate action changes. A second edition is in progress; ISO states it is expected to replace the 2018 edition in the first half of 2027.

Do we still need OHSAS 18001?

No. OHSAS 18001:2007 has been withdrawn, and the migration period ended on 11 September 2021 after an extension from March 2021.

Does the standard require evidence that training worked?

Yes. Clause 7.2 requires the organisation to evaluate the effectiveness of actions taken to acquire competence, which is a separate requirement from recording attendance.

Building the competence evidence

Most ISO 45001 findings on clause 7 are not about missing training. They are about a competence requirement that was never written down, an evaluation step that never happened, or records that cannot be produced on the day. Learnsignal builds compliance and safety training for employers with completion and evaluation reporting designed to be handed to an auditor. To see what is available, explore our CPD courses or see pricing for teams.